github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-10 21:50:05 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #51636 from deads2k/cli-01-reconcile

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 50832, 51119, 51636, 48921, 51712)

add reconcile command to kubectl auth

This pull exposes the RBAC reconcile commands through `kubectl auth reconcile -f FILE`.  When passed a file which contains RBAC roles, rolebindings, clusterroles, or clusterrolebindings, it will compute covers and add the missing rules.

The logic required to properly "apply" rbac permissions is more complicated that a json merge since you have to compute logical covers operations between rule sets.  This means that we cannot use `kubectl apply` to update rbac roles without risking breaking old clients (like controllers).

To solve this problem, RBAC created reconcile functions to use during startup for "stock" roles.  We want to offer this power to users who are running their own controllers and extension servers.

This is an intersection between @kubernetes/sig-auth-misc and @kubernetes/sig-cli-misc
This commit is contained in:
Kubernetes Submit Queue
2017-09-02 19:26:25 -07:00
committed by GitHub
parent f4c6cbdf38 aa637502e0
commit a3aac42b9a
15 changed files with 363 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
hack/make-rules/test-cmd-util.sh
View File

@@ -4670,6 +4670,17 @@ runTests() {
kube::test::if_empty_string "${output_message}"
fi
# kubectl auth reconcile
if kube::test::if_supports_resource "${clusterroles}" ; then
kubectl auth reconcile "${kube_flags[@]}" -f test/fixtures/pkg/kubectl/cmd/auth/rbac-resource-plus.yaml
kube::test::get_object_assert 'rolebindings -n some-other-random -l test-cmd=auth' "{{range.items}}{{$id_field}}:{{end}}" 'testing-RB:'
kube::test::get_object_assert 'roles -n some-other-random -l test-cmd=auth' "{{range.items}}{{$id_field}}:{{end}}" 'testing-R:'
kube::test::get_object_assert 'clusterrolebindings -l test-cmd=auth' "{{range.items}}{{$id_field}}:{{end}}" 'testing-CRB:'
kube::test::get_object_assert 'clusterroles -l test-cmd=auth' "{{range.items}}{{$id_field}}:{{end}}" 'testing-CR:'
kubectl delete "${kube_flags[@]}" rolebindings,role,clusterroles,clusterrolebindings -n some-other-random -l test-cmd=auth
fi
#####################
# Retrieve multiple #
#####################